akm-cli 0.10.261003-beta → 0.10.261005-beta

package/CHANGELOG.md

@@ -6,6 +6,35 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.10.261005] - 2026-10-14
+
+### Changed
+
+- **A process that accepts several proposals commits once, not once per proposal.** `akm proposal drain`,
+  `akm proposal accept --generator` and the triage drain inside `akm improve` used to make one commit (and, on a git-kind
+  bundle, one push) per accepted proposal. They now commit once when they finish, with a subject such as
+  `akm proposal drain: 37 accepted (consolidate-pair 30, consolidate 7)` and one `<id8> <source> <ref>` body line per
+  proposal. In `akm improve`, triage accepts join the run's end-of-run batch commit. A single `akm proposal accept <id>`
+  is still one commit, and `akm proposal accept <id> <id> ...` now accepts several ids in one process and commits them
+  once; an id that fails is reported in the batch result (exit 1) and the others still land.
+
+### Fixed
+
+- **`akm sync` pushes commits that were made earlier.** With a clean working tree it fetched and merged the upstream
+  but never pushed, so a commit made outside `akm sync` (an `akm proposal accept` on a filesystem bundle, an improve
+  run killed before its end-of-run sync, a manual commit) stayed ahead of the remote and `akm sync` reported
+  `pushed: false`. It now pushes those commits when the bundle is writable, has an upstream and push is allowed, and
+  reports `pushed: true`. `--no-push`, read-only bundles and branches without an upstream are unchanged.
+
+## [0.10.261004] - 2026-10-13
+
+### Fixed
+
+- **`akm feedback` fails when it cannot record the feedback** (also in 0.9.32). When `state.db` was read-only to the
+  process, as it is inside an agent sandbox that only allows writes in the workspace, the feedback row was silently
+  dropped and the command still printed `"ok": true`. It now fails with a `DATA_DIR_NOT_WRITABLE` config error (exit
+  78) and records nothing. Add akm's data directory to the sandbox's writable paths.
+
 ## [0.10.261003] - 2026-10-12
 
 ### Fixed

package/dist/commands/feedback-cli.js

@@ -13,17 +13,17 @@ import { parseFrontmatter, parseFrontmatterBlock, spliceFrontmatterLine } from "
 import { conceptIdFromTypeName, parseRefInput, typeNameFromConceptId } from "../core/asset/resolve-ref.js";
 import { isWithin, resolveStashDir, safeRealpath, writeFileAtomic } from "../core/common.js";
 import { loadConfig } from "../core/config/config.js";
-import { NotFoundError, UsageError } from "../core/errors.js";
+import { ConfigError, NotFoundError, UsageError } from "../core/errors.js";
 import { appendEvent } from "../core/events.js";
 import { resolveMutationTarget } from "../core/mutation-target.js";
 import { isPathAbsent } from "../core/path-access.js";
 import { getDbPath } from "../core/paths.js";
-import { withStateDb } from "../core/state-db.js";
+import { getStateDbPath, withStateDb } from "../core/state-db.js";
 import { warn } from "../core/warn.js";
 import { withWriteTargetMutation } from "../core/write-source.js";
 import { recomputeUtilityScores } from "../indexer/indexer.js";
 import { resolveSourceEntries } from "../indexer/search/search-source.js";
-import { insertUsageEvent, resolveUsageEventSource } from "../indexer/usage/usage-events.js";
+import { insertUsageEventStrict, resolveUsageEventSource } from "../indexer/usage/usage-events.js";
 import { resolveSourcesForOrigin } from "../registry/origin-resolve.js";
 import { closeDatabase, openExistingDatabase } from "../storage/repositories/index-connection.js";
 import { findEntryIdByRef, getEntryFilePathById, getItemRefById, } from "../storage/repositories/index-entries-repository.js";
@@ -161,20 +161,28 @@ const UTILITY_REVIEW_THRESHOLD = 0.5;
  * boosting its own picks. This is by design and must not be removed. The
  * utility score is read by improve and metrics only; its update is best-effort
  * and its failure never fails the feedback record or changes the ranking effect.
+ * A failed usage-event write fails the command (DATA_DIR_NOT_WRITABLE).
  */
 function recordFeedbackUsage(indexDb, entryId, durableEntryRef, signal, metadataStr) {
     let utilityResult;
     let rankingSkippedReason;
     const eventSource = resolveUsageEventSource();
     withStateDb((stateDb) => {
-        insertUsageEvent(stateDb, {
-            event_type: "feedback",
-            entry_ref: durableEntryRef,
-            entry_id: entryId,
-            signal,
-            metadata: metadataStr,
-            source: eventSource,
-        });
+        // The usage event IS the feedback record, so a failed write fails the command
+        // instead of reporting ok while nothing was stored.
+        try {
+            insertUsageEventStrict(stateDb, {
+                event_type: "feedback",
+                entry_ref: durableEntryRef,
+                entry_id: entryId,
+                signal,
+                metadata: metadataStr,
+                source: eventSource,
+            });
+        }
+        catch (err) {
+            throw new ConfigError(`Feedback was not recorded: could not write ${getStateDbPath()} (${err instanceof Error ? err.message : String(err)}).`, "DATA_DIR_NOT_WRITABLE");
+        }
         if (eventSource !== "user") {
             rankingSkippedReason =
                 `feedback source is "${eventSource}", not "user" — it does not count toward search ranking, which counts ` +

package/dist/commands/improve/improve.js

@@ -34,6 +34,7 @@ import { getEntryCount } from "../../storage/repositories/index-entries-reposito
 import { openSqliteReadSnapshot, SqliteReadSnapshotUnavailableError } from "../../storage/sqlite-read-snapshot.js";
 import { summarizeLlmUsageRecordsCrossTab } from "../health/llm-usage.js";
 import { drainProposals } from "../proposal/drain.js";
+import { commitCollectedAccepts } from "../proposal/repository.js";
 import { describeGatedLanes, isAutonomyLaneAllowed } from "./autonomy-gate.js";
 import { akmDistill } from "./distill.js";
 import { collectEligibleRefs, collectEligibleRefsReadOnly, memoryCleanupParentRef, resolveImproveScope, shouldAnalyzeMemoryCleanup, } from "./eligibility.js";
@@ -695,9 +696,13 @@ async function runTriagePrePass(run) {
         warn("[improve] triage pre-pass skipped (single-ref scope never drains the whole queue)");
         return undefined;
     }
+    // Triage accepts are journaled, so the end-of-run batch commit covers them; the drain does not commit
+    // them one by one (#1185). Without that batch (--no-sync, no git repository) they are committed here.
+    const commitCollector = [];
     try {
         const triageConfig = improveProfile.processes?.triage;
         return await withLlmStage("triage", () => run.drainProposalsFn({
+            commitCollector,
             stashDir: primaryStashDir,
             ...(options.target ? { target: options.target } : {}),
             config: options.config,
@@ -712,6 +717,10 @@ async function runTriagePrePass(run) {
         warn(`[improve] triage pre-pass failed (non-fatal): ${errMessage(err)}`);
         return undefined;
     }
+    finally {
+        if (!syncsStash(run))
+            commitCollectedAccepts(commitCollector, "akm improve triage");
+    }
 }
 /**
  * The exact repo-relative paths the auto-sync commit stages (#652): the paths
@@ -740,6 +749,11 @@ export function resolveSyncPathSet(input) {
         unattributed: changedPaths.filter((p) => !attributed.has(p) && !initialPaths.has(p) && inScope(p)).sort(),
     };
 }
+/** True when the run's end-of-run sync will commit what it wrote: sync is on and the write target is a git repository. */
+function syncsStash(run) {
+    const repoDir = run.writeTarget?.source.repoPath ?? run.primaryStashDir;
+    return Boolean(run.primaryStashDir && repoDir && run.effectiveSync.enabled !== false && isGitBackedStash(repoDir));
+}
 /**
  * One `saveGitStash` call for the run's write-target bundle, shared by the
  * pre-run sync and the auto-sync commit: never throws, records a `stash_synced`
@@ -749,11 +763,10 @@ export function resolveSyncPathSet(input) {
  * `akm sync` stages (the managed paths).
  */
 function runStashSync(run, eventsCtx, phase, input) {
-    const { writeTarget, primaryStashDir, effectiveSync, options, config, improveProfile } = run;
+    const { writeTarget, primaryStashDir, options, config, improveProfile } = run;
     const repoDir = writeTarget?.source.repoPath ?? primaryStashDir;
-    if (!primaryStashDir || !repoDir || effectiveSync.enabled === false || !isGitBackedStash(repoDir)) {
+    if (!primaryStashDir || !repoDir || !syncsStash(run))
         return undefined;
-    }
     const saveGitStashFn = options.saveGitStashFn ?? saveGitStash;
     const writableOverride = writeTarget ? resolveWritable(writeTarget.config) : resolveWritableOverride(config);
     const push = input.push ?? options.sync?.push ?? improveProfile.sync?.push ?? true;
@@ -786,7 +799,7 @@ function runStashSync(run, eventsCtx, phase, input) {
         const reason = errMessage(syncErr);
         warn(`improve: stash sync failed (non-fatal): ${reason}`);
         // A push that failed after the commit landed still left the commit in the repo.
-        const committed = syncErr instanceof GitStashPushError;
+        const committed = syncErr instanceof GitStashPushError && syncErr.committedNow;
         record({ committed, pushed: false, skipped: true, reason });
         return { committed, pushed: false, skipped: true, reason };
     }

package/dist/commands/proposal/drain.js

@@ -41,7 +41,7 @@ import { NEIGHBOUR_EXCERPT_CHARS, NEIGHBOUR_NOTE_COUNT, nearestKnowledgeNotes, s
 import { errMessage, noticeSet } from "../improve/stage.js";
 import { akmProposalAccept, akmProposalReject } from "./proposal.js";
 import { isRetireProposal, PAIR_PASS_GATE, STALE_TARGET_GATE_REASON } from "./proposal-types.js";
-import { listProposals, listProposalsReadOnly, preflightProposalPromotion, proposalContent, proposalContentHash, readFreshProposalTarget, recordGateDecision, } from "./repository.js";
+import { commitCollectedAccepts, listProposals, listProposalsReadOnly, preflightProposalPromotion, proposalContent, proposalContentHash, readFreshProposalTarget, recordGateDecision, } from "./repository.js";
 /** The gate label on every decision the drain records. */
 const DRAIN_GATE = "triage";
 /** A consolidate promotion: a memory proposed as a new knowledge note. The only kind the judgment tier may accept. */
@@ -89,6 +89,7 @@ async function acceptProposal(opts, proposal, id, reason, promoteFn, rejectFn, j
                 id,
                 ...(opts.target ? { target: opts.target } : {}),
                 ...(opts.config ? { config: opts.config } : {}),
+                ...(opts.commitCollector ? { commitCollector: opts.commitCollector } : {}),
                 gateDecision,
             });
         }
@@ -416,6 +417,17 @@ function readLiveAssetContent(stashDir, ref) {
  * test seams.
  */
 export async function drainProposals(opts, promoteFn = akmProposalAccept, rejectFn = akmProposalReject, judgmentSeams = {}) {
+    if (opts.commitCollector)
+        return drainPending(opts, promoteFn, rejectFn, judgmentSeams);
+    const commitCollector = [];
+    try {
+        return await drainPending({ ...opts, commitCollector }, promoteFn, rejectFn, judgmentSeams);
+    }
+    finally {
+        commitCollectedAccepts(commitCollector, "akm proposal drain");
+    }
+}
+async function drainPending(opts, promoteFn, rejectFn, judgmentSeams) {
     const exclude = opts.excludeIds ?? new Set();
     // A judgment runner's credentials are validated before any live state
     // connection, so its classification reads an isolated snapshot.

package/dist/commands/proposal/proposal-cli.js

@@ -14,7 +14,7 @@
  * registration remains for either spelling.
  */
 import { parsePositiveIntFlag } from "../../cli/parse-args.js";
-import { defineGroupCommand, defineJsonCommand, output } from "../../cli/shared.js";
+import { defineGroupCommand, defineJsonCommand, EXIT_CODES, output } from "../../cli/shared.js";
 import { resolveStashDir } from "../../core/common.js";
 import { loadConfig } from "../../core/config/config.js";
 import { UsageError } from "../../core/errors.js";
@@ -24,7 +24,7 @@ import { resolveImproveExecution } from "../improve/execution.js";
 import { extractCommand } from "../improve/extract-cli.js";
 import { resolveImproveStrategy } from "../improve/improve-strategies.js";
 import { drainProposals } from "./drain.js";
-import { akmProposalAccept, akmProposalDiff, akmProposalList, akmProposalReject, akmProposalReopen, akmProposalRevert, akmProposalShow, bulkAdjudicateProposals, } from "./proposal.js";
+import { akmProposalAccept, akmProposalAcceptMany, akmProposalDiff, akmProposalList, akmProposalReject, akmProposalReopen, akmProposalRevert, akmProposalShow, bulkAdjudicateProposals, } from "./proposal.js";
 import { proposalWaitingSince } from "./proposal-types.js";
 import { proposeCommand } from "./propose-cli.js";
 export function mergeProposalDrainNotices(resolutionNotices, dispatchNotices) {
@@ -94,11 +94,14 @@ const proposalListCommand = defineJsonCommand({
     },
 });
 const proposalAcceptCommand = defineJsonCommand({
-    meta: { name: "accept", description: "Accept a proposal and promote it into the bundle" },
+    meta: {
+        name: "accept",
+        description: "Accept proposals and promote them into the bundle. Several ids are accepted in one process and committed once.",
+    },
     args: {
         id: {
             type: "positional",
-            description: "Proposal id (uuid / prefix) or asset ref (e.g. skills/akm-dream). Optional when --generator is provided.",
+            description: "Proposal id (uuid / prefix) or asset ref (e.g. skills/akm-dream); repeat it to accept several at once. Optional when --generator is provided.",
             required: false,
         },
         queue: { type: "string", description: "Select the proposal queue by source name" },
@@ -161,10 +164,24 @@ const proposalAcceptCommand = defineJsonCommand({
             return;
         }
         if (!args.id) {
-            throw new UsageError("Usage: akm proposal accept <id>  OR  akm proposal accept --generator <generator>", "MISSING_REQUIRED_ARGUMENT");
+            throw new UsageError("Usage: akm proposal accept <id> [<id> ...]  OR  akm proposal accept --generator <generator>", "MISSING_REQUIRED_ARGUMENT");
+        }
+        // citty keeps every positional token in `_`, though it declares only `id`.
+        const ids = (Array.isArray(args._) && args._.length > 0 ? args._ : [args.id]).map(String);
+        if (ids.length > 1) {
+            const results = await akmProposalAcceptMany({
+                ids,
+                queue: args.queue,
+                target: args.bundle,
+            });
+            const failed = results.filter((result) => !result.ok).length;
+            output("proposal-accept-batch", { accepted: results.length - failed, failed, results });
+            if (failed > 0)
+                process.exitCode = EXIT_CODES.GENERAL;
+            return;
         }
         const result = await akmProposalAccept({
-            id: args.id,
+            id: ids[0],
             queue: args.queue,
             target: args.bundle,
         });

package/dist/commands/proposal/proposal.js

@@ -17,7 +17,7 @@ import { NotFoundError } from "../../core/errors.js";
 import { resolveWriteTarget } from "../../core/write-source.js";
 import { withAssetMutationLease } from "../../indexer/index-writer-lock.js";
 import { isRetireProposal, proposalWaitingSince } from "./proposal-types.js";
-import { diffProposal, listProposals, preflightProposalPromotion, promoteProposal, proposalContent, rejectProposalDurably, reopenProposals, resolveProposalId, revertProposal, } from "./repository.js";
+import { commitCollectedAccepts, diffProposal, listProposals, preflightProposalPromotion, promoteProposal, proposalContent, rejectProposalDurably, reopenProposals, resolveProposalId, revertProposal, } from "./repository.js";
 import { validateProposal } from "./validators/proposals.js";
 // ── Shared helpers ──────────────────────────────────────────────────────────
 function resolveStash(stashDir) {
@@ -95,7 +95,12 @@ export async function akmProposalAccept(options) {
     const queue = resolveProposalQueue(options.stashDir, options.queue, config);
     const stash = queue.stashDir;
     const resolvedId = resolveProposalId(stash, options.id).id;
-    const result = await promoteProposal(stash, config, resolvedId, { target: options.target, queueTarget: queue.target, gateDecision: options.gateDecision }, options.ctx);
+    const result = await promoteProposal(stash, config, resolvedId, {
+        target: options.target,
+        queueTarget: queue.target,
+        gateDecision: options.gateDecision,
+        ...(options.commitCollector ? { commitCollector: options.commitCollector } : {}),
+    }, options.ctx);
     return {
         schemaVersion: 1,
         ok: true,
@@ -105,6 +110,35 @@ export async function akmProposalAccept(options) {
         proposal: result.proposal,
     };
 }
+/**
+ * Accept several proposals in one process and commit them once. An id that
+ * fails is reported and the rest carry on; what was accepted is committed
+ * either way.
+ */
+export async function akmProposalAcceptMany(options) {
+    const { ids, ...rest } = options;
+    const commitCollector = [];
+    const results = [];
+    try {
+        for (const id of ids) {
+            try {
+                results.push(await akmProposalAccept({ ...rest, id, commitCollector }));
+            }
+            catch (error) {
+                results.push({
+                    schemaVersion: 1,
+                    ok: false,
+                    id,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+    }
+    finally {
+        commitCollectedAccepts(commitCollector, "akm proposal accept");
+    }
+    return results;
+}
 export async function akmProposalReject(options) {
     return withAssetMutationLease("proposal-reject", async () => {
         const config = options.config ?? loadConfig();
@@ -273,16 +307,29 @@ export async function bulkAdjudicateProposals(options) {
     const skippedForContinuityRisk = matched.filter(isContinuityExcluded).length;
     const pending = matched.filter((p) => !isContinuityExcluded(p));
     const results = [];
-    for (const proposal of pending) {
-        if (options.dryRun) {
-            results.push({ id: proposal.id, ref: proposal.ref, source: proposal.source, dryRun: true });
-        }
-        else if (options.action === "accept") {
-            results.push(await akmProposalAccept({ stashDir, id: proposal.id, queue: options.queue, target: options.target, config }));
-        }
-        else {
-            results.push(await akmProposalReject({ stashDir, id: proposal.id, queue: options.queue, reason: options.reason, config }));
+    const commitCollector = [];
+    try {
+        for (const proposal of pending) {
+            if (options.dryRun) {
+                results.push({ id: proposal.id, ref: proposal.ref, source: proposal.source, dryRun: true });
+            }
+            else if (options.action === "accept") {
+                results.push(await akmProposalAccept({
+                    stashDir,
+                    id: proposal.id,
+                    queue: options.queue,
+                    target: options.target,
+                    config,
+                    commitCollector,
+                }));
+            }
+            else {
+                results.push(await akmProposalReject({ stashDir, id: proposal.id, queue: options.queue, reason: options.reason, config }));
+            }
         }
     }
+    finally {
+        commitCollectedAccepts(commitCollector, "akm proposal accept");
+    }
     return { count: results.length, results, skippedForContinuityRisk };
 }

package/dist/commands/proposal/repository.js

@@ -1060,6 +1060,37 @@ function requireAcceptedTarget(proposal) {
 function acceptCommitMessage(proposal) {
     return `akm accept: ${proposal.source} ${proposal.id.slice(0, 8)} ${proposal.ref}`;
 }
+function commitAccept(collector, target, proposal, paths) {
+    if (collector)
+        collector.push({ target, proposal, paths });
+    else
+        commitAcceptedPaths(target, acceptCommitMessage(proposal), paths);
+}
+/**
+ * Commit everything `collector` holds, one commit per target repository: a lone
+ * accept keeps its own subject; several get `<label>: N accepted (source count,
+ * ...)` with one `<id8> <source> <ref>` body line per proposal. Empties the
+ * collector. A failed commit only warns, as for a single accept.
+ */
+export function commitCollectedAccepts(collector, label) {
+    const byRepo = new Map();
+    for (const entry of collector.splice(0)) {
+        const key = path.resolve(entry.target.source.repoPath ?? entry.target.source.path);
+        byRepo.set(key, [...(byRepo.get(key) ?? []), entry]);
+    }
+    for (const entries of byRepo.values()) {
+        const first = entries[0];
+        if (entries.length === 1) {
+            commitAcceptedPaths(first.target, acceptCommitMessage(first.proposal), first.paths);
+            continue;
+        }
+        const counts = new Map();
+        for (const { proposal } of entries)
+            counts.set(proposal.source, (counts.get(proposal.source) ?? 0) + 1);
+        const bySource = [...counts].sort((a, b) => b[1] - a[1]).map(([source, count]) => `${source} ${count}`);
+        commitAcceptedPaths(first.target, `${label}: ${entries.length} accepted (${bySource.join(", ")})`, entries.flatMap((entry) => entry.paths), entries.map(({ proposal }) => `${proposal.id.slice(0, 8)} ${proposal.source} ${proposal.ref}`));
+    }
+}
 /**
  * O1 (alpha.9): an accepted consolidate PROMOTION retires its source memory
  * (and its `.derived` twin), so promotion no longer leaves a memory/
@@ -1163,7 +1194,7 @@ async function promoteProposalWithLease(stashDir, config, id, options, ctx) {
     const paths = [assetPath];
     if (accepted.status === "accepted" && accepted.source === "consolidate")
         retirePromotionSource(mutationTarget, accepted, paths);
-    commitAcceptedPaths(mutationTarget, acceptCommitMessage(accepted), paths);
+    commitAccept(options.commitCollector, mutationTarget, accepted, paths);
     return { proposal: accepted, assetPath, ref: accepted.ref };
 }
 /**
@@ -1422,7 +1453,7 @@ async function retireProposalWithLease(stashDir, config, proposal, options, ctx)
         paths.push(twinPath, path.join(mutationTarget.source.path, twinRecord.archivedPath), path.join(mutationTarget.source.path, twinRecord.auditPath));
     }
     if (paths.length > 0)
-        commitAcceptedPaths(mutationTarget, acceptCommitMessage(proposal), paths);
+        commitAccept(options.commitCollector, mutationTarget, proposal, paths);
     if (archiveDirs.length === 0) {
         // Recorded intent, but neither file is at its original location NOR
         // archived under this proposal's id: something else removed the target

package/dist/core/errors.js

@@ -10,6 +10,7 @@ const CONFIG_HINTS = {
     STASH_DIR_NOT_A_DIRECTORY: "The configured default bundle path exists but isn't a directory. Update it to point at a folder.",
     STASH_DIR_UNREADABLE: "Check the path exists and your user has read permission, or update the default bundle path.",
     DATA_DIR_UNREADABLE: "The data directory is not readable by the user running akm. Check its owner and mode, or point AKM_DATA_DIR / XDG_DATA_HOME somewhere this user owns.",
+    DATA_DIR_NOT_WRITABLE: "Nothing was recorded. Make the akm data directory writable for this process (for an agent sandbox, add it to the writable paths), or point AKM_DATA_DIR / XDG_DATA_HOME somewhere this user can write, then retry.",
     INDEX_SCHEMA_INCOMPATIBLE: "Run `akm index --full` to rebuild the derived index from the currently materialized sources.",
     LLM_NOT_CONFIGURED: 'Run `akm setup` or configure an `engines` entry with `kind: "llm"`, then select it with `defaults.llmEngine`.',
     TEST_ISOLATION_MISSING: "Under bun test, when AKM_BUNDLE_DIR is set you MUST also set XDG_DATA_HOME (or AKM_DATA_DIR) and XDG_STATE_HOME (or AKM_STATE_DIR) to temp directories so the test does not touch the developer's real ~/.local/share/akm or ~/.local/state/akm.",

package/dist/core/write-source.js

@@ -22,7 +22,8 @@
  * {@link commitWriteTargetBoundary} once — or wrap a custom mutation in
  * {@link withWriteTargetMutation}, which does both under the asset lease. An
  * accepted proposal commits its own paths ({@link commitAcceptedPaths}), on a
- * filesystem stash that is a git repository too.
+ * filesystem stash that is a git repository too. A process that accepts many
+ * proposals collects them and commits once at its boundary (#1185).
  */
 import fs from "node:fs";
 import path from "node:path";
@@ -423,6 +424,7 @@ export function commitWriteTargetBoundary(target, message, options) {
         const saved = saveGitStash(undefined, message, resolveWritable(target.config), {
             repoDir,
             paths: committable,
+            ...(options?.body ? { body: options.body } : {}),
             ...(options?.push === undefined ? {} : { push: options.push }),
         });
         if (saved.reason)
@@ -430,9 +432,10 @@ export function commitWriteTargetBoundary(target, message, options) {
     }
     catch (error) {
         if (error instanceof GitStashPushError) {
-            throw new Error(`Changes were committed as ${error.commit}, but publication failed: ${error.message}`, {
-                cause: error,
-            });
+            const what = error.committedNow
+                ? `Changes were committed as ${error.commit}`
+                : `Nothing new to commit; earlier commits up to ${error.commit} are unpushed`;
+            throw new Error(`${what}, but publication failed: ${error.message}`, { cause: error });
         }
         throw error;
     }
@@ -443,10 +446,11 @@ export function commitWriteTargetBoundary(target, message, options) {
  * boundary commit skips, locally (the end-of-run sync pushes). A failed commit
  * only warns, since the accept already landed.
  */
-export function commitAcceptedPaths(target, message, paths) {
+export function commitAcceptedPaths(target, message, paths, body) {
     try {
         commitWriteTargetBoundary(target, message, {
             paths,
+            ...(body ? { body } : {}),
             filesystem: true,
             ...(target.source.kind === "git" ? {} : { push: false }),
         });

package/dist/indexer/usage/usage-events.js

@@ -55,14 +55,18 @@ export function ensureUsageEventsSchema(db) {
  */
 export function insertUsageEvent(db, event) {
     try {
-        db.prepare(`INSERT INTO usage_events (event_type, query, entry_id, entry_ref, signal, metadata, source)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`).run(event.event_type, event.query ?? null, event.entry_id ?? null, event.entry_ref ?? null, event.signal ?? null, event.metadata ?? null, event.source ?? "unknown");
+        insertUsageEventStrict(db, event);
     }
     catch (error) {
         rethrowIfTestIsolationError(error);
         /* fire-and-forget: silently ignore errors */
     }
 }
+/** Insert a usage event and let a failed write throw, for callers whose record is the event itself. */
+export function insertUsageEventStrict(db, event) {
+    db.prepare(`INSERT INTO usage_events (event_type, query, entry_id, entry_ref, signal, metadata, source)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`).run(event.event_type, event.query ?? null, event.entry_id ?? null, event.entry_ref ?? null, event.signal ?? null, event.metadata ?? null, event.source ?? "unknown");
+}
 // ── Query ────────────────────────────────────────────────────────────────────
 /**
  * User feedback counts for many assets at once, keyed by durable `entry_ref`.

package/dist/scripts/akm-migrate-node.js

@@ -25658,6 +25658,7 @@ var CONFIG_HINTS = {
   STASH_DIR_NOT_A_DIRECTORY: "The configured default bundle path exists but isn't a directory. Update it to point at a folder.",
   STASH_DIR_UNREADABLE: "Check the path exists and your user has read permission, or update the default bundle path.",
   DATA_DIR_UNREADABLE: "The data directory is not readable by the user running akm. Check its owner and mode, or point AKM_DATA_DIR / XDG_DATA_HOME somewhere this user owns.",
+  DATA_DIR_NOT_WRITABLE: "Nothing was recorded. Make the akm data directory writable for this process (for an agent sandbox, add it to the writable paths), or point AKM_DATA_DIR / XDG_DATA_HOME somewhere this user can write, then retry.",
   INDEX_SCHEMA_INCOMPATIBLE: "Run `akm index --full` to rebuild the derived index from the currently materialized sources.",
   LLM_NOT_CONFIGURED: 'Run `akm setup` or configure an `engines` entry with `kind: "llm"`, then select it with `defaults.llmEngine`.',
   TEST_ISOLATION_MISSING: "Under bun test, when AKM_BUNDLE_DIR is set you MUST also set XDG_DATA_HOME (or AKM_DATA_DIR) and XDG_STATE_HOME (or AKM_STATE_DIR) to temp directories so the test does not touch the developer's real ~/.local/share/akm or ~/.local/state/akm.",

package/dist/scripts/akm-migrate.js

@@ -24986,6 +24986,7 @@ var CONFIG_HINTS = {
   STASH_DIR_NOT_A_DIRECTORY: "The configured default bundle path exists but isn't a directory. Update it to point at a folder.",
   STASH_DIR_UNREADABLE: "Check the path exists and your user has read permission, or update the default bundle path.",
   DATA_DIR_UNREADABLE: "The data directory is not readable by the user running akm. Check its owner and mode, or point AKM_DATA_DIR / XDG_DATA_HOME somewhere this user owns.",
+  DATA_DIR_NOT_WRITABLE: "Nothing was recorded. Make the akm data directory writable for this process (for an agent sandbox, add it to the writable paths), or point AKM_DATA_DIR / XDG_DATA_HOME somewhere this user can write, then retry.",
   INDEX_SCHEMA_INCOMPATIBLE: "Run `akm index --full` to rebuild the derived index from the currently materialized sources.",
   LLM_NOT_CONFIGURED: 'Run `akm setup` or configure an `engines` entry with `kind: "llm"`, then select it with `defaults.llmEngine`.',
   TEST_ISOLATION_MISSING: "Under bun test, when AKM_BUNDLE_DIR is set you MUST also set XDG_DATA_HOME (or AKM_DATA_DIR) and XDG_STATE_HOME (or AKM_STATE_DIR) to temp directories so the test does not touch the developer's real ~/.local/share/akm or ~/.local/state/akm.",

package/dist/sources/providers/git-stash.js

@@ -127,10 +127,13 @@ export function checkGitPathSafety(repoDir, pathspec) {
 }
 export class GitStashPushError extends Error {
     commit;
-    constructor(message, commit) {
+    /** False when the push was of commits made earlier (nothing was committed by this call). */
+    committedNow;
+    constructor(message, commit, committedNow = true) {
         super(message);
         this.name = "GitStashPushError";
         this.commit = commit;
+        this.committedNow = committedNow;
     }
 }
 const GIT_PUSH_TIMEOUT_MS = 120_000;
@@ -191,7 +194,11 @@ export function saveGitStash(name, message, writableOverride, options) {
     // Co-Authored-By: someone-else"` and forge trailers in the commit log.
     // Empty result falls back to the timestamped default.
     const sanitized = message ? sanitizeCommitMessage(message) : "";
-    const commitMessage = sanitized || `akm save ${timestamp}`;
+    const bodyLines = (options?.body ?? []).map(sanitizeCommitMessage).filter(Boolean);
+    const commitMessage = [
+        sanitized || `akm save ${timestamp}`,
+        ...(bodyLines.length > 0 ? ["", ...bodyLines] : []),
+    ].join("\n");
     const transactionId = options?.transactionId;
     if (transactionId !== undefined && !/^[A-Za-z0-9._-]{1,128}$/.test(transactionId)) {
         throw new Error("Invalid Git transaction identifier.");
@@ -317,22 +324,12 @@ export function saveGitStash(name, message, writableOverride, options) {
             commit: exactCommit,
         };
     }
-    const pushResult = runGit([
-        "-C",
-        repoDir,
-        "push",
-        `--force-with-lease=${pushTarget.mergeRef}:${pushTarget.upstreamHead}`,
-        pushTarget.remote,
-        `${readOptionalHead(repoDir) ?? exactCommit}:${pushTarget.mergeRef}`,
-    ], { timeout: GIT_PUSH_TIMEOUT_MS });
-    if (pushResult.status !== 0) {
-        throw new GitStashPushError(`git push failed: ${pushResult.stderr?.trim() || "unknown error"}`, exactCommit);
-    }
+    const pushOutput = pushToUpstream(repoDir, pushTarget, readOptionalHead(repoDir) ?? exactCommit, exactCommit);
     return {
         committed: true,
         pushed: true,
         skipped: false,
-        output: pushResult.stdout.trim() || "changes committed and pushed",
+        output: pushOutput || "changes committed and pushed",
         commit: exactCommit,
     };
 }
@@ -343,12 +340,46 @@ function readHasRemote(repoDir) {
     }
     return remoteResult.stdout.trim().length > 0;
 }
-/** Nothing to commit still brings in the upstream, so a host with no changes of its own keeps up. */
+/**
+ * Push `head` to the upstream, leased on the upstream head just read. Throws {@link GitStashPushError}
+ * (carrying `commit`) when git refuses. Returns git's stdout.
+ */
+function pushToUpstream(repoDir, target, head, commit, committedNow = true) {
+    const pushResult = runGit([
+        "-C",
+        repoDir,
+        "push",
+        `--force-with-lease=${target.mergeRef}:${target.upstreamHead}`,
+        target.remote,
+        `${head}:${target.mergeRef}`,
+    ], { timeout: GIT_PUSH_TIMEOUT_MS });
+    if (pushResult.status !== 0) {
+        throw new GitStashPushError(`git push failed: ${pushResult.stderr?.trim() || "unknown error"}`, commit, committedNow);
+    }
+    return pushResult.stdout.trim();
+}
+/**
+ * Nothing to commit still brings in the upstream, so a host with no changes of its own keeps up. Commits
+ * made earlier and never pushed (a proposal accept, a killed improve run) are pushed here, once the
+ * branch is up to date with its upstream and ahead of it.
+ */
 function nothingToCommit(repoDir, output, syncWithRemote) {
     const integration = syncWithRemote ? integrateUpstream(repoDir) : undefined;
     if (integration && "blocked" in integration) {
         return { committed: false, pushed: false, skipped: false, reason: `not pushed: ${integration.blocked}`, output };
     }
+    // readUpstreamConfig is undefined on a detached HEAD or a branch with no upstream: nothing to push.
+    const head = syncWithRemote && readUpstreamConfig(repoDir) ? readOptionalHead(repoDir) : undefined;
+    const upstream = head ? readActualUpstream(repoDir, head) : undefined;
+    if (head && typeof upstream === "object" && upstream.upstreamHead !== head) {
+        const pushOutput = pushToUpstream(repoDir, upstream, head, head, false);
+        return {
+            committed: false,
+            pushed: true,
+            skipped: false,
+            output: pushOutput || `pushed ${upstream.upstreamHead.slice(0, 7)}..${head.slice(0, 7)}`,
+        };
+    }
     return { committed: false, pushed: false, skipped: false, output: integration?.integrated ?? output };
 }
 function readUpstreamConfig(repoDir) {

package/docs/architecture/0.10-process-rules.md

@@ -658,7 +658,7 @@ Paths are relative to the rules-010 checkout. `drain.ts` is `src/commands/propos
 - **Judgment verdict handling** — The judge returns accept, reject or defer, and parse failures and runner errors leave the item deferred (`judgment-parse-failure`, `judgment-error`). A judge reject becomes an auto-reject (`judgment-reject`). The judge sees the live asset (for a promotion, which is a create, the prompt prints "(none — this proposal would create a new asset)"), same-ref sibling proposals, and, only for such a create, the 5 nearest knowledge notes (300-character excerpts, plus promotions accepted earlier in the same drain). It is told to reject a promotion those notes already cover, or one that reports changing state ("as of <date>", a rollout, a plan not yet carried out). A lesson drawn from an incident is durable. *Why:* the model never sees `knowledge/` otherwise, and 18 of 51 promotions minted on 2026-10-07 and later rejected held 30% or more in a neighbouring doc. (`drain.ts:253-306,371-497,499-534`; `src/commands/improve/consolidate/coverage.ts:154-186`)
 - **Judgment queue-mode staging** — In `queue` mode a judged accept is stamped `staged` (`judgment-accept`) with its content hash, for a later promote run. (`drain.ts:444-464`)
 - **Excluded proposals** — `excludeIds` is always empty in improve (`improve.ts:869`); "this run's fresh proposals are never touched" is an ordering effect, because the pre-pass runs before consolidation mints. `--older-than <days>` on `proposal drain` excludes proposals younger than that, counted from creation or the last reopen, and fails safe by excluding any proposal whose age cannot be computed. (`drain.ts:559-564`; `src/commands/proposal/proposal-cli.ts:468-505`; `src/commands/proposal/proposal-types.ts:316-326`; `improve.ts:869`)
-- **What auto-accept means for git** — Every auto-accept is the ordinary promote path, so it writes the asset and commits it to the target with the subject `akm accept: <source> <8-char id> <ref>`. For a consolidate promotion the commit also carries the archived source memory and its tombstone. Filesystem targets never push; a git-kind target uses the default push behaviour. Commit failure is only a warning, not a failure of the accept. The standalone `drain --promote` asks for confirmation before promoting ("commit to git and cannot be batch-reverted"). A revert is per proposal (`akm proposal revert`). (`src/commands/proposal/repository.ts:1459-1462,1574-1596`; `src/core/write-source.ts:615-627`; `proposal-cli.ts:471-482`)
+- **What auto-accept means for git** — Every auto-accept is the ordinary promote path, so it writes the asset and commits it to the target with the subject `akm accept: <source> <8-char id> <ref>`, but a loop of accepts (`drain`, bulk `accept --generator`, `accept <id> <id>`) commits once per process: `<label>: N accepted (<source> n, ...)` with one `<id8> <source> <ref>` body line per proposal (#1185). Inside `akm improve` the triage accepts join the run's end-of-run batch commit (or, with sync off or no git repository, are committed once when the pre-pass ends). For a consolidate promotion the commit also carries the archived source memory and its tombstone. Filesystem targets never push; a git-kind target uses the default push behaviour. Commit failure is only a warning, not a failure of the accept. The standalone `drain --promote` asks for confirmation before promoting ("commit to git and cannot be batch-reverted"). A revert is per proposal (`akm proposal revert`). (`src/commands/proposal/repository.ts` (`commitAccept`, `commitCollectedAccepts`); `src/core/write-source.ts` (`commitAcceptedPaths`); `proposal-cli.ts:471-482`)
 - **Drain failures stay pending** — An attempt that fails (validation, promote error) is listed under `failed` with a categorized reason and the proposal stays pending. A rejected proposal is recorded with a gate decision under gate `triage`. (`drain.ts:142-150,641-656`)
 
 ## Proposals and feedback

package/docs/architecture/improvement.md

@@ -117,9 +117,12 @@ everything else routes through `akm proposal accept`.
 7. `akm proposal accept` promotes the proposal into the bundle; `akm proposal
    revert` restores the prior content from the backup captured at promotion
    time, if the proposal overwrote an existing asset. When the bundle is a git
-   repository (a `.git` directory, whatever its source kind), each accept is
-   committed as it happens, locally and with exactly the paths it wrote or
-   removed: `akm accept: <generator> <proposal-id-8> <ref>`. A retirement's
+   repository (a `.git` directory, whatever its source kind), an accept is
+   committed locally with exactly the paths it wrote or removed:
+   `akm accept: <generator> <proposal-id-8> <ref>`. A process that accepts
+   several (`akm proposal drain`, a bulk accept, `accept <id> <id>`) commits them
+   once at its end, with a summary subject and one body line per proposal; in
+   `akm improve` the triage accepts join the end-of-run batch commit. A retirement's
    archived copy and tombstone, and the source memory a consolidate promotion
    retires, go in the same commit. A commit that fails warns and the accept
    stands.
@@ -438,7 +441,7 @@ tombstone `retiredAt` is more than 30 days old (`RETIRE_GRACE_DAYS`) AND
 whose archive directory is entirely git-tracked and clean (`git ls-files`
 plus `git status --porcelain -uall`, both checked once per sweep, not once
 per directory). `.git` presence alone does not guarantee a retirement was
-ever committed: an accept commits its own paths (`commitAcceptedPaths` in
+ever committed: an accept commits its own paths, once per process (`commitAcceptedPaths` in
 `src/core/write-source.ts`), on a `kind: "filesystem"` source with a `.git`
 directory too, but a commit that failed only warned, and a retirement accepted
 by an older akm left archived bytes sitting on disk with no commit behind them

package/docs/reference/cli.md

@@ -3058,6 +3058,7 @@ UUID, an 8-character UUID prefix, or an asset ref.
 
 ```sh
 akm proposal accept <id>
+akm proposal accept <id> <id> <id>             # several at once: one commit
 akm proposal accept 7c115132                  # 8-char UUID prefix
 akm proposal accept skills/akm-dream           # Asset ref
 akm proposal accept <id> --queue team-bundle
@@ -3081,10 +3082,19 @@ Bulk-accept all pending proposals from one generator with `--generator <name>`
 (e.g. `reflect`, `distill`) and no positional id. Bulk accept requires
 `-y`/`--yes` in non-interactive shells.
 
+Several ids accept in one process and return one `proposal-accept-batch`
+envelope (`accepted`, `failed`, and a `results` list in argument order). An id
+that fails appears as `{ ok: false, id, error }`, the command exits 1, and the
+others are still accepted and committed.
+
 When the destination bundle is a git repository (a `.git` directory, whatever
-its source kind), each accept is committed as it happens, with exactly the paths
-it wrote or removed and the subject `akm accept: <generator> <proposal-id-8>
-<ref>`. A retirement's archived copy and tombstone, and the source memory a
+its source kind), one accept is committed with exactly the paths it wrote or
+removed and the subject `akm accept: <generator> <proposal-id-8> <ref>`. A
+process that accepts several proposals (several ids, `--generator`, or
+`akm proposal drain`) commits them once at its end: the subject is
+`akm proposal accept: N accepted (<generator> n, ...)` (`akm proposal drain: ...`
+for a drain) and the body has one `<proposal-id-8> <generator> <ref>` line per
+proposal. A retirement's archived copy and tombstone, and the source memory a
 consolidate promotion retires, are part of the same commit. The commit is local:
 `akm sync`, or the end-of-run sync of `akm improve`, pushes it. A commit that
 fails warns and the accept stands.

package/docs/reference/data-and-telemetry.md

@@ -79,6 +79,12 @@ mode and owner, and the uid you are running as. They do **not** report an empty
 index. `akm health` stays runnable in that state and reports it as a failing
 `state-db-readable` check, so it remains the command to reach for.
 
+If akm can read this directory but **cannot write** it — an agent sandbox that
+only allows writes inside the workspace, for instance — `akm feedback` fails with
+a `DATA_DIR_NOT_WRITABLE` config error (exit 78) and records nothing, instead of
+reporting success for feedback it could not store. Add the data directory to the
+sandbox's writable paths.
+
 > **0.9.1 note.** A pre-release build briefly chmodded this directory to `0700`
 > and the databases to `0600` on every open. That was reverted: it silently
 > changed the permissions of directories akm did not create, which broke installs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akm-cli",
-  "version": "0.10.261003-beta",
+  "version": "0.10.261005-beta",
   "type": "module",
   "description": "akm (Agent Knowledge Manager) — a portable, local-first capability library for AI agents. Discover, load, share, and improve reusable skills, scripts, workflows, and knowledge across any shell-capable coding agent, including Claude Code, OpenCode, and Cursor.",
   "keywords": [